# Types of penetration testing: by target, knowledge and starting point

Source: https://penetrationtestservices.com/guides/types-of-penetration-testing/
Publisher: Excession Labs (penetrationtestservices.com)
Last updated: 2026-11-09

The types of penetration testing sorted on three axes (target, tester knowledge, starting point), plus a decision table that maps your situation to the test to ask for.

> **Short answer:** Penetration tests differ on three axes. Target: web app, API, network, cloud, mobile or wireless. Tester knowledge: black, grey or white box. Starting point: external, internal or assumed breach. Name one choice on each axis in your scope. For a SaaS product, the usual request is a grey box test of the web app and API from a signed-in starting point.

The types of penetration testing are easiest to sort on three axes: what you test (the target), what the tester knows (black, grey or white box), and where the tester starts (outside, inside or with a stolen account). Every real scope picks one value on each axis. Lists of "seven types" mix the axes, which is why they overlap.

## What three questions define a pentest type?

A pentest type is the answer to three questions: what is in scope, how much does the tester know, and from where does the attack begin.

| Axis | Question | Typical values |
|---|---|---|
| Target | Which system is tested? | Web app, API, network, cloud, mobile, wireless |
| Knowledge | What does the tester know up front? | Black, grey, white box |
| Starting point | Where does the tester begin? | External, internal, assumed breach |

A test called "network pentest" says only the first answer. "Grey box web and API test from a signed-in tenant account" answers all three, and a provider can quote it without guessing. Put all three in the written scope. See [rules of engagement](/guides/penetration-testing-rules-of-engagement/) for the other parts of that document.

## Which types exist by target?

The target decides which methods the tester uses and which checklist applies.

- Web application: Tests logins, sessions, authorization, input handling and business logic in the browser-facing app. The OWASP Web Security Testing Guide is the common reference. See [web application penetration testing](/web-application-penetration-testing/).
- API: Tests the endpoints that apps and partners call. The OWASP API Security Top 10 (2023) starts with broken object level authorization (API1:2023). See [API penetration testing](/api-penetration-testing/).
- Network: Tests hosts, services and segmentation, from outside the perimeter or from inside it.
- Cloud: Tests configuration and exposed services in a cloud account. Check the provider policy first. AWS says customers may test permitted services without prior approval, and that testing with command and control (C2) needs prior approval.
- Mobile: Tests the app binary, local storage and the API behind it.
- Wireless: Tests Wi-Fi and related radio networks on site.

Excession Labs scopes web applications, APIs, multi-tenant SaaS platforms and AI applications. We do not scope physical access, social engineering or network red team work. For AI applications, see the [AI red teaming service](https://airedteamingservices.com/).

## What are black, grey and white box tests?

The knowledge axis says how much the tester knows before the test starts. NIST SP 800-115 describes the same idea as the amount of information given to the tester.

| Type | Tester gets | Best for |
|---|---|---|
| Black box | Nothing but the target name | The outside view of an exposed system |
| Grey box | Test accounts, API docs, role descriptions | SaaS apps and APIs, where an attacker may hold an account |
| White box | Source code, architecture, configuration | Deep coverage in the time available |

Grey box is the usual default for web apps and APIs, because authorization flaws only show up when the tester holds accounts. Our guide to [black box, grey box and white box testing](/guides/black-box-grey-box-white-box-testing/) gives the trade-offs in full.

## What are external, internal and assumed breach tests?

The starting point says where the attack begins. PCI DSS requirement 11.4.1 defines internal testing as testing from inside the network and external testing as testing from outside it.

- External: The tester starts on the internet with no access. It finds what any visitor can reach.
- Internal: The tester starts inside the network or on a corporate device. It finds what a compromised laptop or a malicious insider could reach.
- Assumed breach: The tester starts with one valid account or foothold, because phishing or credential reuse makes that a realistic start. For a multi-tenant SaaS product, this is a signed-in user in tenant A who tries to reach tenant B.

[External vs internal penetration testing](/guides/external-vs-internal-penetration-testing/) covers the first two in detail.

## Which type matches your goal?

The reason you buy the test often decides the type. Compliance programs name a test but rarely name its style, so ask your auditor which parts they need.

- Compliance: PCI DSS 11.4 asks for internal and external testing. SOC 2 and ISO 27001 leave the form to you and your auditor. See [SOC 2 penetration testing](/soc-2-penetration-testing/).
- Pre-launch: A grey box test of the new app and API before real data arrives. See [pre-launch security testing](/pre-launch-security-testing/).
- Customer security review: A buyer asks for a recent third-party report. See [customer security review](/customer-security-review/).
- After a release: A focused test of the changed features. See [recurring penetration testing](/recurring-penetration-testing/).

## How do you choose? A decision table

Start from your situation and read across to the three axes.

| Your situation | Target | Knowledge | Starting point |
|---|---|---|---|
| New SaaS product, first real customers | Web app and API | Grey box | Assumed breach (signed-in user) |
| Multi-tenant data separation worry | API and web app | Grey box, two tenants | Assumed breach |
| Public marketing site with a login | Web app | Black box | External |
| PCI DSS in scope | Per your QSA | Per your QSA | Internal and external |
| Enterprise buyer wants a report | Web app and API | Grey box | Assumed breach |
| Mobile app plus backend | Mobile and API | Grey box | Assumed breach |
| Major release of one feature | That feature | White or grey box | Assumed breach |

> **Demonstration only:** This table is a demonstration of how to map a situation to a scope. No real customer system was tested. Your auditor or buyer may require different choices.
## What is a pentest not?

A pentest is a person testing a defined scope with written authorization. Three other services get confused with it.

- A vulnerability scan is automated matching of known issues. It finds candidates, and a human confirms them.
- A security audit compares controls with a standard. It does not attack the system.
- A red team exercise tests detection and response against a goal, often across people and process. See [red team vs penetration testing](/guides/red-team-vs-penetration-testing/).

Testing without written authorization from the system owner can be a crime, whatever the intent. Excession Labs tests only with that authorization.

## What should you ask before you accept a scope?

Use these questions to check that the scope names a type, not just a label.

1. Which assets are in scope, and which are out?
2. Is it black, grey or white box, and which accounts and roles will the tester get?
3. Where does the test start: external, internal or signed in?
4. Is production tested, and which limits apply to uploads, email and password guessing?
5. Does the report show evidence for each finding, and does it list controls that held?
6. Is a retest included, and what does it cover?

If you want a first test at no charge, see the [free pentest pilot](/free-pentest/).

## Questions

### How many types of penetration testing are there?

No standard fixes a number. Vendor lists range from five to seven because they mix three axes in one list: what is tested, what the tester knows, and where the tester starts. Pick one value on each axis and write it in the scope.

### Which type of pentest does a SaaS company need first?

Most SaaS teams start with a grey box test of the web app and API, with test accounts in two tenants. That covers the places where customer data is exposed: authentication, authorization and tenant isolation.

### Is a vulnerability scan a type of penetration test?

No. A scanner matches known signatures and reports possible issues. A pentest has a person try to exploit weaknesses, chain them and prove the effect. Treat a scan as an input to a test, not a replacement.

### Do physical and social engineering tests belong in a web app pentest?

No. They are separate engagements with separate authorization, and Excession Labs does not scope them. Our scoped targets are web applications, APIs, multi-tenant SaaS platforms and AI applications.

## Sources

- [NIST SP 800-115: Technical Guide to Information Security Testing and Assessment](https://csrc.nist.gov/pubs/sp/800/115/final)
- [PCI SSC Information Supplement: Penetration Testing Guidance v1.1](https://listings.pcisecuritystandards.org/documents/Penetration-Testing-Guidance-v1_1.pdf)
- [OWASP Web Security Testing Guide](https://wstg.owasp.org/)
- [OWASP API Security Top 10 2023](https://owasp.org/API-Security/editions/2023/en/0x00-header/)
- [AWS Penetration Testing policy](https://aws.amazon.com/security/penetration-testing/)
- [PCI SSC: PCI DSS v3.2.1 to v4.0 Summary of Changes (requirement 11.4.1)](https://listings.pcisecuritystandards.org/documents/PCI-DSS-v3-2-1-to-v4-0-Summary-of-Changes-r1.pdf)